ClawHub
Back to skill

Security audit

OpenClaw VPS Security Preflight

Security checks across malware telemetry and agentic risk

Overview

This skill is a read-only VPS security preflight that checks local OpenClaw and Linux security posture without changing configuration or sending data out.

Install only if you want an agent to run local security checks on an OpenClaw VPS you control. Treat raw audit output as sensitive, avoid using --show-audit unless needed, and require separate explicit approval before applying any suggested remediation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Session Persistence

Medium
Category
Rogue Agent
Content
fi

if command_exists systemctl; then
  user_enabled=$(systemctl --user list-unit-files 'openclaw-gateway*.service' --state=enabled --no-legend 2>/dev/null || true)
  system_enabled=$(systemctl list-unit-files 'openclaw-gateway*.service' --state=enabled --no-legend 2>/dev/null || true)
  if [[ -n "$user_enabled$system_enabled" ]]; then
    pass 'An OpenClaw systemd service is enabled for reboot survival.'
Confidence
80% confidence
Finding
systemctl --user list-unit-files 'openclaw-gateway*.service' --state=enable

Session Persistence

Medium
Category
Rogue Agent
Content
if command_exists systemctl; then
  user_enabled=$(systemctl --user list-unit-files 'openclaw-gateway*.service' --state=enabled --no-legend 2>/dev/null || true)
  system_enabled=$(systemctl list-unit-files 'openclaw-gateway*.service' --state=enabled --no-legend 2>/dev/null || true)
  if [[ -n "$user_enabled$system_enabled" ]]; then
    pass 'An OpenClaw systemd service is enabled for reboot survival.'
  else
Confidence
80% confidence
Finding
systemctl list-unit-files 'openclaw-gateway*.service' --state=enable

Session Persistence

Medium
Category
Rogue Agent
Content
user_enabled=$(systemctl --user list-unit-files 'openclaw-gateway*.service' --state=enabled --no-legend 2>/dev/null || true)
  system_enabled=$(systemctl list-unit-files 'openclaw-gateway*.service' --state=enabled --no-legend 2>/dev/null || true)
  if [[ -n "$user_enabled$system_enabled" ]]; then
    pass 'An OpenClaw systemd service is enabled for reboot survival.'
  else
    warn 'No enabled OpenClaw systemd service was detected.'
  fi
Confidence
80% confidence
Finding
systemd service is enable

Session Persistence

Medium
Category
Rogue Agent
Content
fi

if command_exists systemctl && {
  run_quiet systemctl is-enabled apt-daily-upgrade.timer ||
  run_quiet systemctl is-enabled unattended-upgrades.service ||
  run_quiet systemctl is-enabled dnf-automatic.timer ||
  run_quiet systemctl is-enabled dnf5-automatic.timer;
Confidence
80% confidence
Finding
systemctl is-enable

Session Persistence

Medium
Category
Rogue Agent
Content
if command_exists systemctl && {
  run_quiet systemctl is-enabled apt-daily-upgrade.timer ||
  run_quiet systemctl is-enabled unattended-upgrades.service ||
  run_quiet systemctl is-enabled dnf-automatic.timer ||
  run_quiet systemctl is-enabled dnf5-automatic.timer;
}; then
Confidence
80% confidence
Finding
systemctl is-enable

Session Persistence

Medium
Category
Rogue Agent
Content
if command_exists systemctl && {
  run_quiet systemctl is-enabled apt-daily-upgrade.timer ||
  run_quiet systemctl is-enabled unattended-upgrades.service ||
  run_quiet systemctl is-enabled dnf-automatic.timer ||
  run_quiet systemctl is-enabled dnf5-automatic.timer;
}; then
  pass 'An automatic security-update service or timer is enabled.'
Confidence
80% confidence
Finding
systemctl is-enable

Session Persistence

Medium
Category
Rogue Agent
Content
run_quiet systemctl is-enabled apt-daily-upgrade.timer ||
  run_quiet systemctl is-enabled unattended-upgrades.service ||
  run_quiet systemctl is-enabled dnf-automatic.timer ||
  run_quiet systemctl is-enabled dnf5-automatic.timer;
}; then
  pass 'An automatic security-update service or timer is enabled.'
else
Confidence
80% confidence
Finding
systemctl is-enable

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.